Add security plans for gh-aspnet-webapp and sample-web-app#118
Conversation
emmanuelknafo
commented
Feb 5, 2026
emmanuelknafo
commented
- Created a comprehensive security plan for the gh-aspnet-webapp blueprint, detailing architecture, data flows, threat assessments, and mitigation strategies.
- Developed a security plan for the sample-web-app, outlining its three-tier architecture, security posture, threat summary, and implementation checklist.
- Created a comprehensive security plan for the gh-aspnet-webapp blueprint, detailing architecture, data flows, threat assessments, and mitigation strategies. - Developed a security plan for the sample-web-app, outlining its three-tier architecture, security posture, threat summary, and implementation checklist.
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned Files
|
1 similar comment
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Snapshot WarningsEnsure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice. Scanned Files
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| AZURE_LOCATION: ${{ github.event.inputs.azure_location || 'DEFAULT_LOCATION' }} | ||
| outputs: | ||
| acr_name: ${{ steps.deploy.outputs.acr_name }} | ||
| webapp_name: ${{ steps.deploy.outputs.webapp_name }} |
Check warning
Code scanning / CodeQL
Unpinned tag for a non-immutable Action in workflow Medium
| @@ -0,0 +1,192 @@ | |||
| @description('The Azure region for resource deployment.') | |||
Check failure
Code scanning / templateanalyzer
Use Advanced Threat Protection. Error
| @@ -0,0 +1,192 @@ | |||
| @description('The Azure region for resource deployment.') | |||
Check failure
Code scanning / templateanalyzer
Enable auditing for Azure SQL DB server. Error
| resource sqlServer 'Microsoft.Sql/servers@2023-08-01-preview' = { | ||
| name: sqlServerName | ||
| location: location | ||
| properties: { |
Check failure
Code scanning / templateanalyzer
Use AAD authentication with SQL databases. Error
| @description('SQL Database for application data.') | ||
| resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { | ||
| parent: sqlServer | ||
| name: sqlDatabaseName | ||
| location: location | ||
| sku: { | ||
| name: 'S1' | ||
| tier: 'Standard' | ||
| } | ||
| properties: { | ||
| collation: 'SQL_Latin1_General_CP1_CI_AS' | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Azure SQL Server threat detection alerts are enabled for all threat types Error
| @description('SQL Database for application data.') | ||
| resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { | ||
| parent: sqlServer | ||
| name: sqlDatabaseName | ||
| location: location | ||
| sku: { | ||
| name: 'S1' | ||
| tier: 'Standard' | ||
| } | ||
| properties: { | ||
| collation: 'SQL_Latin1_General_CP1_CI_AS' | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure that 'Auditing' is set to 'On' for SQL servers Error
| @description('SQL Database for application data.') | ||
| resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { | ||
| parent: sqlServer | ||
| name: sqlDatabaseName | ||
| location: location | ||
| sku: { | ||
| name: 'S1' | ||
| tier: 'Standard' | ||
| } | ||
| properties: { | ||
| collation: 'SQL_Latin1_General_CP1_CI_AS' | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure that 'Email service and co-administrators' is 'Enabled' for MSSQL servers Error
| @description('SQL Database for application data.') | ||
| resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { | ||
| parent: sqlServer | ||
| name: sqlDatabaseName | ||
| location: location | ||
| sku: { | ||
| name: 'S1' | ||
| tier: 'Standard' | ||
| } | ||
| properties: { | ||
| collation: 'SQL_Latin1_General_CP1_CI_AS' | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure that 'Send Alerts To' is enabled for MSSQL servers Error
| @description('SQL Database for application data.') | ||
| resource sqlDatabase 'Microsoft.Sql/servers/databases@2023-08-01-preview' = { | ||
| parent: sqlServer | ||
| name: sqlDatabaseName | ||
| location: location | ||
| sku: { | ||
| name: 'S1' | ||
| tier: 'Standard' | ||
| } | ||
| properties: { | ||
| collation: 'SQL_Latin1_General_CP1_CI_AS' | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure the Azure SQL Database Namespace is zone redundant Error
| @description('App Service for web application.') | ||
| resource appService 'Microsoft.Web/sites@2023-12-01' = { | ||
| name: appServiceName | ||
| location: location | ||
| identity: { | ||
| type: 'SystemAssigned' | ||
| } | ||
| properties: { | ||
| serverFarmId: appServicePlan.id | ||
| httpsOnly: true | ||
| siteConfig: { | ||
| minTlsVersion: '1.2' | ||
| ftpsState: 'Disabled' | ||
| alwaysOn: true | ||
| appSettings: [ | ||
| { | ||
| name: 'APPINSIGHTS_INSTRUMENTATIONKEY' | ||
| value: appInsights.properties.InstrumentationKey | ||
| } | ||
| { | ||
| name: 'APPLICATIONINSIGHTS_CONNECTION_STRING' | ||
| value: appInsights.properties.ConnectionString | ||
| } | ||
| { | ||
| name: 'KeyVaultUri' | ||
| value: keyVault.properties.vaultUri | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure that 'HTTP Version' is the latest if used to run the web app Error
| @description('App Service for web application.') | ||
| resource appService 'Microsoft.Web/sites@2023-12-01' = { | ||
| name: appServiceName | ||
| location: location | ||
| identity: { | ||
| type: 'SystemAssigned' | ||
| } | ||
| properties: { | ||
| serverFarmId: appServicePlan.id | ||
| httpsOnly: true | ||
| siteConfig: { | ||
| minTlsVersion: '1.2' | ||
| ftpsState: 'Disabled' | ||
| alwaysOn: true | ||
| appSettings: [ | ||
| { | ||
| name: 'APPINSIGHTS_INSTRUMENTATIONKEY' | ||
| value: appInsights.properties.InstrumentationKey | ||
| } | ||
| { | ||
| name: 'APPLICATIONINSIGHTS_CONNECTION_STRING' | ||
| value: appInsights.properties.ConnectionString | ||
| } | ||
| { | ||
| name: 'KeyVaultUri' | ||
| value: keyVault.properties.vaultUri | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure the web app has 'Client Certificates (Incoming client certificates)' set Error
| @description('App Service Plan for hosting.') | ||
| resource appServicePlan 'Microsoft.Web/serverfarms@2023-12-01' = { | ||
| name: appServicePlanName | ||
| location: location | ||
| sku: { | ||
| name: 'P1v3' | ||
| tier: 'PremiumV3' | ||
| } | ||
| properties: { | ||
| reserved: false | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure the App Service Plan is zone redundant Error
| @description('Key Vault for secrets management.') | ||
| resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = { | ||
| name: keyVaultName | ||
| location: location | ||
| properties: { | ||
| sku: { | ||
| family: 'A' | ||
| name: 'standard' | ||
| } | ||
| tenantId: subscription().tenantId | ||
| enableRbacAuthorization: true | ||
| enableSoftDelete: true | ||
| softDeleteRetentionInDays: 90 | ||
| enablePurgeProtection: true | ||
| networkAcls: { | ||
| defaultAction: 'Deny' | ||
| bypass: 'AzureServices' | ||
| } | ||
| } | ||
| } |
Check failure
Code scanning / checkov
Ensure that Azure Key Vault disables public network access Error
| @description('App Service for web application.') | ||
| resource appService 'Microsoft.Web/sites@2023-12-01' = { | ||
| name: appServiceName | ||
| location: location | ||
| identity: { | ||
| type: 'SystemAssigned' | ||
| } | ||
| properties: { | ||
| serverFarmId: appServicePlan.id | ||
| httpsOnly: true | ||
| siteConfig: { | ||
| minTlsVersion: '1.2' | ||
| ftpsState: 'Disabled' | ||
| alwaysOn: true | ||
| appSettings: [ | ||
| { | ||
| name: 'APPINSIGHTS_INSTRUMENTATIONKEY' | ||
| value: appInsights.properties.InstrumentationKey | ||
| } | ||
| { | ||
| name: 'APPLICATIONINSIGHTS_CONNECTION_STRING' | ||
| value: appInsights.properties.ConnectionString | ||
| } | ||
| { | ||
| name: 'KeyVaultUri' | ||
| value: keyVault.properties.vaultUri | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| } |
Check notice
Code scanning / checkov
Ensure App Service has a minimum number of instances for failover Note
2 participants
